Synology DiskStation Manager: Improper link resolution in thumb (CVE-2026-19048)
An improper link resolution vulnerability in the 'thumb' component of Synology DiskStation Manager allows an authenticated remote user to perform arbitrary file writes, potentially resulting in denial-of-service or system compromise.
CVE search metadata
CVE search record: CVE-2026-19048. Severity: high. CVSS: 8.1. KEV: no. Product: DiskStation Manager (< 7.3.2-86009-5), DiskStation Manager (< 7.4.1-90080-1). Brief: Synology DiskStation Manager: Improper link resolution in thumb (CVE-2026-19048). Brief link: https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-vulnerability-cve-2026-19048/
Triage facts
Revision 1- Applicability
- DiskStation Manager (< 7.3.2-86009-5), DiskStation Manager (< 7.4.1-90080-1)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 08:10 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Synology DiskStation Manager (DSM) is affected by an improper link resolution before file access vulnerability (CVE-2026-19048) within the 'thumb' component. This vulnerability allows an authenticated remote attacker to write arbitrary files to the system, which may facilitate denial-of-service conditions or unauthorized modifications.
Impact
The vulnerability is assigned a CVSS v3.1 base score of 8.1. Successful exploitation by an authenticated remote attacker can lead to arbitrary file write operations, potentially resulting in system instability or denial-of-service.
Recommendation
Upgrade Synology DiskStation Manager (DSM) to version 7.3.2-86009-5 or later, or 7.4.1-90080-1 or later, to address the vulnerability documented in CVE-2026-19048.
Mitigations
Upgrade Synology DiskStation Manager (DSM) to 7.3.2-86009-5 or 7.4.1-90080-1 or later
CVE-2026-19048